video-breakdown

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes ffmpeg and ffprobe binaries via subprocess.run in scripts/process_video.py to perform video metadata extraction and frame splitting. The binary paths are configurable via environment variables (FFMPEG_BIN, FFPROBE_BIN), following standard development practices for local media processing.
  • [EXTERNAL_DOWNLOADS]: The scripts/process_video.py script downloads video content from external URLs provided as input using the httpx library. This is a primary function of the skill to allow processing of remote media files.
  • [DATA_EXFILTRATION]: The scripts/video_upload.py script includes functionality to upload local files to ByteDance's Tornado Object Storage (TOS). While intended for video processing workflows, this capability allows for the transfer of local files to remote vendor infrastructure, which could be misused if targeted at sensitive system files.
  • [PROMPT_INJECTION]: The skill processes untrusted video data from remote URLs, which constitutes a surface for indirect prompt injection if the resulting frames or metadata are subsequently interpreted as instructions by an AI agent.
  • Ingestion points: video_url parameter in scripts/process_video.py.
  • Boundary markers: Absent; the downloaded content is passed directly to media processing tools.
  • Capability inventory: Local file read/write, network transmission via httpx and tos SDK, and shell command execution via subprocess.run (FFmpeg).
  • Sanitization: None; the skill assumes inputs are valid media files for FFmpeg processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 05:20 PM
Security Audit — agent-trust-hub — video-breakdown